Social Engineering — Phishing, Pretexting & Security Awareness

In this tutorial, learn social engineering: phishing, pretexting, baiting. Why it matters: 85% of attacks use psychology. By the end, recognize and defend.

Social engineering is the psychological manipulation of people into performing actions or divulging confidential information, exploiting trust, fear, urgency, and authority rather than technical vulnerabilities.

What Is Social Engineering? (The Why First)

Think of social engineering like a con artist tricking a bank teller. The con artist does not break into the vault — they convince the teller to open it for them. They might dress as a bank manager (impersonation), claim there is an emergency (urgency), or say the bank president ordered it (authority). Social engineering in cybersecurity works the same way. Attackers do not hack the computer — they hack the person using it.

Technical controls like firewalls, encryption, and antivirus are necessary, but they cannot stop a user from willingly giving their password to someone who sounds like the IT help desk. This is why social engineering is the most dangerous category of attack — it targets the one element no patch can fix.

Learning Path

flowchart LR
  A[Security Basics] --> B[Cyber Security Awareness]
  B --> C[Social Engineering]
  C --> D[Phishing Defense]
  D --> E[Incident Response]
  C --> F[Security Operations]
  C --> G{You Are Here}
  style G fill:#f90,color:#fff

Social Engineering Attack Types

Phishing

Phishing is the most common social engineering attack. Attackers send fraudulent emails that appear to come from legitimate sources to trick recipients into revealing credentials, downloading malware, or transferring money.

Phishing subtypes:

Code Example: Phishing Email Header Analysis

import re

def analyze_email_headers(headers):
    indicators = []
    received_chain = re.findall(r"Received: from (\[?\d+\.\d+\.\d+\.\d+\]?)", headers)
    reply_to = re.search(r"Reply-To:\s(.+)", headers)
    return_path = re.search(r"Return-Path:\s<(.+)>", headers)
    from_field = re.search(r"From:\s(.+)", headers)
    spf = re.search(r"spf=(fail|softfail|neutral)", headers)
    dkim = re.search(r"dkim=(fail|neutral)", headers)

    if spf:
        indicators.append(f"SPF check failed: {spf.group(1)}")
    if dkim:
        indicators.append(f"DKIM check failed: {dkim.group(1)}")
    if reply_to and from_field:
        reply_domain = re.search(r"@(.+)>", reply_to.group(1))
        from_domain = re.search(r"@(.+)>", from_field.group(1))
        if reply_domain and from_domain and reply_domain.group(1) != from_domain.group(1):
            indicators.append(f"Reply-To domain ({reply_domain.group(1)}) differs from From domain ({from_domain.group(1)})")
    if len(received_chain) < 2:
        indicators.append("Short received chain — possible spoofed headers")

    return indicators

email_headers = """
Received: from mail.evil.com (192.168.1.100)
Received: from smtp.evil.com (10.0.0.50)
From: "DodaTech Support" <support@dodatech.com>
Reply-To: "DodaTech Support" <support@dodatech-support.net>
Return-Path: <bounce@evil.com>
Authentication-Results: spf=fail; dkim=neutral
"""

results = analyze_email_headers(email_headers)
for r in results:
    print(f"[!] {r}")
if not results:
    print("[+] No phishing indicators found")

Expected output:

[!] SPF check failed: fail
[!] DKIM check failed: neutral
[!] Reply-To domain (dodatech-support.net) differs from From domain (dodatech.com)
[!] Short received chain — possible spoofed headers

Email header analysis reveals inconsistencies that users cannot see. The Reply-To address going to a different domain than the From address is a classic phishing indicator. Automated email security tools perform these checks on every incoming message.

Pretexting

Pretexting involves creating a fabricated scenario (the pretext) to steal information. The attacker researches the target to build credibility using OSINT and then contacts them with a believable story.

Real-world example: An attacker calls an employee pretending to be from the IT department. They say there is a critical security update and need the employee's password to install it. The attacker has researched the employee's name, department, and manager to sound legitimate.

Baiting

Baiting offers something enticing in exchange for information or access. Physical baiting involves leaving USB drives labeled "Confidential" or "Employee Bonuses" in parking lots. The victim plugs the drive into their computer, and malware executes automatically.

Tailgating

Tailgating (or piggybacking) is following an authorized person into a restricted area without proper credentials. An attacker waits near a secure door holding boxes and asks an employee to hold the door. The employee, wanting to be helpful, grants access. This bypasses physical controls like Zero Trust access systems that require continuous verification.

Psychological Principles Attackers Exploit

Security Awareness Training

Building an Awareness Program

Effective security awareness training changes behavior, not just knowledge. Here is a structured approach:

Code Example: Phishing Simulation Email Generator

import random
import smtplib
from email.mime.text import MIMEText

templates = [
    {
        "subject": "Your password expires in 24 hours",
        "body": "Dear {name},\n\nYour account password will expire in 24 hours. Click below to reset it:\n\nhttps://phishing-sim.company.com/reset\n\nIT Support]
    },
    {
        "subject": "Unusual login attempt detected",
        "body": "Dear {name},\n\nWe detected an unusual login attempt from {ip}. If this was not you, please verify your account immediately:\n\nhttps://phishing-sim.company.com/verify\n\nSecurity Team"
    },
    {
        "subject": "Employee benefits update — action required",
        "body": "Dear {name},\n\nOpen enrollment for 2026 benefits closes this Friday. Review and update your selections here:\n\nhttps://phishing-sim.company.com/benefits\n\nHR Department"
    }
]

employees = [
    {"name": "John Doe", "email": "jdoe"@company".com"},
    {"name": "Jane Smith", "email": "jsmith"@company".com"},
]

def send_simulation(employee):
    template = random.choice(templates)
    body = template["body"].format(name=employee["name"], ip=f"203.0.113.{random.randint(1, 254)}")
    msg = MIMEText(body)
    msg["Subject"] = template["subject"]
    msg["From"] = "security@company.com"
    msg["To"] = employee["email"]
    print(f"Sending to {employee['email']}")
    print(f"Subject: {msg['Subject']}")
    print(f"Body:\n{body}\n")

for emp in employees:
    send_simulation(emp)

Expected output:

Sending to jdoe@company.com
Subject: Your password expires in 24 hours
Body:
Dear John Doe,

Your account password will expire in 24 hours. Click below to reset it:

https://phishing-sim.company.com/reset

IT Support

Sending to jsmith@company.com
Subject: Unusual login attempt detected
Body:
Dear Jane Smith,

We detected an unusual login attempt from 203.0.113.42. If this was not you, please verify your account immediately:

https://phishing-sim.company.com/verify

Security Team

In real phishing simulations, the links lead to a training page that informs the user they clicked a simulated phishing email and provides immediate education. The simulation platform tracks click rates per department over time.

Technical Controls Against Social Engineering

While training reduces human error, technical controls prevent attacks from reaching users in the first place.

Practice Questions

1. What is the difference between phishing and spear phishing?

Phishing is a mass attack sending identical emails to thousands of recipients. Spear phishing targets specific individuals with personalized content based on research. Spear phishing has a higher success rate because the email appears relevant to the recipient's role or interests.

2. Why is authority such an effective social engineering trigger?

People are conditioned from childhood to comply with authority figures. In a workplace, employees naturally follow instructions from executives, IT support, and security teams. Attackers exploit this by impersonating these roles, knowing most employees will comply without verification.

3. How does multi-factor authentication protect against phishing even if a user gives away their password?

MFA requires a second factor that the attacker cannot obtain from the phishing email. Even if the user types their username and password into the fake page, the attacker cannot log in without the second factor (phone approval, hardware token, biometric). This is why MFA is the single most effective control against credential phishing.

4. What should you do if you suspect you have received a phishing email?

Do not click any links or open attachments. Report the email to your security team using the designated reporting channel (usually a "Report Phishing" button). If you have already clicked a link, inform your security team immediately so they can check for malware and reset affected credentials.

5. Challenge: Conduct a Social Engineering Audit

Design and conduct a controlled social engineering assessment in a lab environment: craft three phishing emails targeting different roles (employee, manager, executive), attempt a pretexting phone call to extract information from a volunteer playing the target role, and attempt a tailgating exercise into a restricted area. Document each attempt and analyze why each technique succeeded or failed.

Real-World Task: Build a Security Awareness Training Module

Create a 30-minute security awareness training module for new employees covering:

1. Social engineering overview (what it is and why it matters)
2. Attack types with real examples (phishing, pretexting, baiting, tailgating, vishing)
3. Red flags checklist (7+ indicators to look for in suspicious communications)
4. Reporting procedures (how and when to report suspicious activity)
5. Interactive quiz with 10 questions covering recognition and response scenarios
6. Resources and contact information for the security team

FAQ

What's Next

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.